procyberian/emacs
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Another fix for using pointer to buffer text

Browse source 
* src/search.c (Freplace_match): Move the call to BYTE_POS_ADDR
after the call to xpalloc, to avoid the danger of buffer text
relocation after its address was taken.  (Bug#24358)
This commit is contained in:
Eli Zaretskii 2016-10-24 16:59:34 +03:00
parent 31219927a9
commit 1047496722
1 changed files with 7 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
src/search.c
View file

@ -2640,6 +2640,7 @@ since only regular expressions have distinguished subexpressions. */)
const unsigned char *add_stuff = NULL; const unsigned char *add_stuff = NULL;
ptrdiff_t add_len = 0; ptrdiff_t add_len = 0;
ptrdiff_t idx = -1; ptrdiff_t idx = -1;
ptrdiff_t begbyte;
if (str_multibyte) if (str_multibyte)
{ {
@ -2702,11 +2703,10 @@ since only regular expressions have distinguished subexpressions. */)
set up ADD_STUFF and ADD_LEN to point to it. */ set up ADD_STUFF and ADD_LEN to point to it. */
if (idx >= 0) if (idx >= 0)
{ {
ptrdiff_t begbyte = CHAR_TO_BYTE (search_regs.start[idx]); begbyte = CHAR_TO_BYTE (search_regs.start[idx]);
add_len = CHAR_TO_BYTE (search_regs.end[idx]) - begbyte; add_len = CHAR_TO_BYTE (search_regs.end[idx]) - begbyte;
if (search_regs.start[idx] < GPT && GPT < search_regs.end[idx]) if (search_regs.start[idx] < GPT && GPT < search_regs.end[idx])
move_gap_both (search_regs.start[idx], begbyte); move_gap_both (search_regs.start[idx], begbyte);
add_stuff = BYTE_POS_ADDR (begbyte);
} }
/* Now the stuff we want to add to SUBSTED /* Now the stuff we want to add to SUBSTED
@ -2719,6 +2719,11 @@ since only regular expressions have distinguished subexpressions. */)
add_len - (substed_alloc_size - substed_len), add_len - (substed_alloc_size - substed_len),
STRING_BYTES_BOUND, 1); STRING_BYTES_BOUND, 1);
/* We compute this after the call to xpalloc, because that
could cause buffer text be relocated when ralloc.c is used. */
if (idx >= 0)
add_stuff = BYTE_POS_ADDR (begbyte);
/* Now add to the end of SUBSTED. */ /* Now add to the end of SUBSTED. */
if (add_stuff) if (add_stuff)
{ {